CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L
What the vulnerability does
The Migration, Backup, Staging – WPvivid Backup & Migration plugin for WordPress is vulnerable to arbitrary directory deletion due to insufficient file path validation in the delete_cancel_staging_site() function in all versions up to, and including, 0.9.128. This makes it possible for authenticated attackers, with Administrator-level access and above, to delete arbitrary folders on the server, which leads to a loss of data.
Explanation of Vulnerability in Simple Terms
WPvivid Backup, Migration & Staging versions up to 0.9.128 contain a vulnerability that allows high-privilege users to modify site data or cause temporary unavailability. The vulnerability requires administrator-level access and does not affect data confidentiality. A patch version has not been publicly identified.
What an attacker can do
Modify site data or cause temporary service disruption.
Potential impact on your site
An admin account compromise could allow data modification or brief downtime; confidentiality is not at risk.
Conditions required to exploit
Attacker must have administrator-level access to the WordPress site.
Key dates
External resources
